Read the docs
TI-2020-11211 Aliases CVE-2020-14340GHSA-c738-77x8-wmq5

Uncontrolled resource consumption in XNIO

Priority LOW 31CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 13 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

Why it matters now

EPSS 0.02212 82nd percentileScored 2026-11-07
Fix Partial org.jboss.xnio:xnio-nio (Maven): 3.8.2.Final, 3.7.9.FinalRed Hat: 7 advisoriesRed Hat: 7 fixed, 13 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—XNIOxnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final—No fix listedCNA
—org.jboss.xnio:xnio-nio (Maven)3.8.0.Final to before 3.8.2.Final3.8.2.FinalPatch availableGHSA-c738-77x8-wmq5
—org.jboss.xnio:xnio-nio (Maven)3.6.0 to before 3.7.9.Final3.7.9.FinalPatch availableGHSA-c738-77x8-wmq5
  • XNIO Vendor— Affected xnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final Fixed in — No fix listed CNA
  • org.jboss.xnio:xnio-nio (Maven) Vendor— Affected 3.8.0.Final to before 3.8.2.Final Fixed in 3.8.2.Final Patch available GHSA-c738-77x8-wmq5
  • org.jboss.xnio:xnio-nio (Maven) Vendor— Affected 3.6.0 to before 3.7.9.Final Fixed in 3.7.9.Final Patch available GHSA-c738-77x8-wmq5

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:redhat:xnio:*:*:*:*:*:*:*:*3.6.1 to before 3.7.9; 3.8.0 to before 3.8.2VulnerableRed Hat
cpe:2.3:a:redhat:xnio:3.6.0:beta1:*:*:*:*:*:*3.6.0 beta1VulnerableRed Hat
cpe:2.3:a:redhat:xnio:3.6.0:beta2:*:*:*:*:*:*3.6.0 beta2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_brms:5:*:*:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:a:redhat:jboss_brms:6:*:*:*:*:*:*:*6VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:-:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:xnio:*:*:*:*:*:*:*:* Versions 3.6.1 to before 3.7.9; 3.8.0 to before 3.8.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:xnio:3.6.0:beta1:*:*:*:*:*:* Versions 3.6.0 beta1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:xnio:3.6.0:beta2:*:*:*:*:*:* Versions 3.6.0 beta2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_brms:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_brms:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:-:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
  • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-c738-77x8-wmq5 org.jboss.xnio:xnio-nio (Maven) Fixed in 3.8.2.Final Advisory →
  • Fix · GHSA-c738-77x8-wmq5 org.jboss.xnio:xnio-nio (Maven) Fixed in 3.7.9.Final Advisory →

Red Hat 7 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:5361 Released 2020-12-16 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.2 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:4931 Released 2020-11-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.3 security update
    • Red Hat Single Sign-On 7.4.3
Show 4 more Red Hat advisories
  • RHSA-2020:4247 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update
    • EAP 7.3.3
  • RHSA-2020:4246 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el7eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el7eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el7eap +47
  • RHSA-2020:4245 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el8eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el8eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el8eap +47
  • RHSA-2020:4244 Released 2020-10-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-5.redhat_00011.1.el6eap, eap7-activemq-artemis-cli-2.9.0-5.redhat_00011.1.el6eap, eap7-activemq-artemis-commons-2.9.0-5.redhat_00011.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Continuous DeliveryAffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
EAP 7.3.3Fixed RHSA-2020:4247
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:4245
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:4244
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:4246
Red Hat Single Sign-On 7.4.3Fixed RHSA-2020:4931
Text-Only RHOARFixed RHSA-2020:5361
Not affected: 5 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel K 1
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14340
  2. 2026-10-03 Alias added: GHSA-c738-77x8-wmq5

References

Patch 2

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences